Skip to content

feat: prefer podman over docker as default container engine #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jul 17, 2026
+29 −33
Merged

feat: prefer podman over docker as default container engine #106

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 18 additions & 15 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,9 @@ CI_IMAGE_TAG ?= latest
REPO_URL ?= https://github.com/openshift-online/rosa-regional-platform-api
GIT_REF ?= main

# Container engine: prefer podman, fall back to docker
CONTAINER_ENGINE ?= $(shell command -v podman 2>/dev/null || command -v docker 2>/dev/null)

# Detect host platform for native builds
HOST_OS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
HOST_ARCH := $(shell uname -m)
Expand Down Expand Up @@ -69,8 +72,8 @@ help:
@echo " verify - Verify go.mod is tidy"
@echo ""
@echo "Docker:"
@echo " image - Build Docker image"
@echo " image-push - Push Docker image"
@echo " image - Build container image"
@echo " image-push - Push container image"
@echo " image-e2e - Build E2E test container (single platform)"
@echo " image-e2e-multiarch - Build E2E test container (multiarch)"
@echo " image-e2e-push-multiarch - Build and push E2E test container (multiarch)"
Expand Down Expand Up @@ -186,9 +189,9 @@ lint:
# Run linter in CI container with fresh clone (reproduces Prow CI exactly)
lint-ci-container:
@echo "Building CI container image..."
docker build -f ci/Containerfile -t $(CI_IMAGE_REPO):$(CI_IMAGE_TAG) .
$(CONTAINER_ENGINE) build -f ci/Containerfile -t $(CI_IMAGE_REPO):$(CI_IMAGE_TAG) .
@echo "Running linter in CI container with fresh clone from $(REPO_URL)@$(GIT_REF)..."
docker run --rm \
$(CONTAINER_ENGINE) run --rm \
$(CI_IMAGE_REPO):$(CI_IMAGE_TAG) \
bash -c "git clone $(REPO_URL) /tmp/repo && cd /tmp/repo && git checkout $(GIT_REF) && ./ci/lint.sh"

Expand All @@ -197,29 +200,29 @@ clean:
rm -f $(BINARY_NAME)
rm -f coverage.out coverage.html

# Build Docker image
# Build container image
image:
docker build --platform $(GOOS)/$(GOARCH) -t $(IMAGE_REPO):$(IMAGE_TAG) .
docker tag $(IMAGE_REPO):$(IMAGE_TAG) $(IMAGE_REPO):$(GIT_SHA)
$(CONTAINER_ENGINE) build --platform $(GOOS)/$(GOARCH) -t $(IMAGE_REPO):$(IMAGE_TAG) .
$(CONTAINER_ENGINE) tag $(IMAGE_REPO):$(IMAGE_TAG) $(IMAGE_REPO):$(GIT_SHA)

# Build E2E test container (single platform)
image-e2e:
docker build -f Containerfile.e2e \
$(CONTAINER_ENGINE) build -f Containerfile.e2e \
--platform $(GOOS)/$(GOARCH) \
-t $(IMAGE_REPO)-e2e:$(IMAGE_TAG) .
docker tag $(IMAGE_REPO)-e2e:$(IMAGE_TAG) $(IMAGE_REPO)-e2e:$(GIT_SHA)
$(CONTAINER_ENGINE) tag $(IMAGE_REPO)-e2e:$(IMAGE_TAG) $(IMAGE_REPO)-e2e:$(GIT_SHA)

# Build E2E test container for multiple architectures
image-e2e-multiarch:
docker buildx build -f Containerfile.e2e \
$(CONTAINER_ENGINE) buildx build -f Containerfile.e2e \
--platform $(PLATFORMS) \
-t $(IMAGE_REPO)-e2e:$(IMAGE_TAG) \
-t $(IMAGE_REPO)-e2e:$(GIT_SHA) \
--load .
Comment on lines +217 to 221

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Inspect Makefile targets =="
rg -n -A8 -B2 '^(image-e2e-multiarch|test-e2e-container):' Makefile

echo
echo "== Check Podman buildx --load support (if podman exists) =="
if command -v podman >/dev/null 2>&1; then
  podman buildx build --help | rg -n -- '--load|--manifest|--platform' || true
else
  echo "podman not installed on this machine; skip runtime check."
fi

Repository: openshift-online/rosa-regional-platform-api

Length of output: 1243

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Check CONTAINER_ENGINE definition in Makefile =="
rg -n "CONTAINER_ENGINE\s*[?:=]" Makefile | head -20

echo
echo "== Check for Podman/Docker conditional logic =="
rg -n "podman|docker|CONTAINER_ENGINE" Makefile | head -30

echo
echo "== Look for related targets or workarounds =="
rg -n -B2 -A5 "buildx|--load" Makefile

echo
echo "== Check for any documentation about Podman compatibility =="
fd -t f "README|CONTRIBUTING|docs" -o -name "*podman*" -o -name "*docker*" 2>/dev/null | head -10
if [ -f "README.md" ]; then
  echo "=== Checking README.md for Podman/Docker guidance ==="
  rg -n -i "podman|docker.*buildx|--load" README.md || true
fi

Repository: openshift-online/rosa-regional-platform-api

Length of output: 1956

🌐 Web query:

Podman buildx build --load incompatibility issues limitations

💡 Result:

The command podman buildx build is not a full implementation of the Docker buildx tool. Instead, it serves as a compatibility alias for the native podman build command [1][2][3]. Because of this design, several key limitations and incompatibility issues exist: 1. Alias Limitations: Podman does not natively integrate with BuildKit (the engine behind Docker's buildx) [4]. When you run podman buildx build, Podman simply executes its own build engine (Buildah) [1][5]. Consequently, many features exclusive to Docker's buildx (such as advanced builder drivers or specific BuildKit-only options) are either unavailable or strictly limited [1][6]. 2. --load Incompatibility: In Docker, --load is a shorthand for outputting to the local image store [7]. While Podman ignores or provides compatibility for some basic flags to prevent script failures [7][2], it does not support the full range of BuildKit-specific build outputs or the native BuildKit "container" driver behavior [4]. Because Podman does not use BuildKit, attempting to use advanced buildx workflows that rely on BuildKit's internal state—such as cross-platform building via --platform or complex build contexts—often fails or requires significant manual workarounds like exporting to OCI tarballs and using podman load [4][8][9]. 3. Feature Gaps: Users frequently encounter errors when scripts rely on other buildx features such as --push (which is shorthand for --output=type=registry) [6]. Since Podman does not implement these BuildKit-native flags, such commands will fail with "unknown flag" errors or simply remain unsupported [6]. 4. Workarounds: If your workflow requires BuildKit-specific features, you cannot rely on the podman buildx alias. Instead, you must use BuildKit directly (e.g., via buildctl) to produce OCI images or tarballs, and subsequently import those images into the Podman storage manually using podman load [4][8][9]. Alternatively, you should use native Podman commands (podman build) and adapt your CI/CD pipelines to avoid dependencies on Docker-specific buildx/BuildKit syntax [6].

Citations:

image-e2e-multiarch and image-e2e-push-multiarch targets fail with Podman.

The Makefile auto-selects Podman when available (line 28), but both multiarch targets use unsupported BuildKit-specific flags:

  • image-e2e-multiarch (lines 217–221) uses --load, which Podman does not support
  • image-e2e-push-multiarch (lines 224–229) uses --push, which Podman does not support
  • Both use --platform with buildx, a BuildKit-only feature unavailable in Podman

Podman's buildx is merely an alias for podman build and does not provide full Docker BuildKit compatibility. Implement engine-specific logic (e.g., conditional targets or a wrapper function) to use native Podman commands when Podman is selected, or fall back to Docker.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` around lines 217 - 221, The image-e2e-multiarch and
image-e2e-push-multiarch targets use BuildKit-specific flags (--platform with
buildx, --load, and --push) that Podman does not support since Podman's buildx
is just an alias for podman build. Implement engine-specific logic by either
creating separate conditional targets or using a conditional check within each
target that branches based on the CONTAINER_ENGINE variable. For Podman, use
native podman build commands without the unsupported flags, or alternatively
document and enforce that these targets require Docker. For Docker, keep the
existing buildx build commands with the --platform, --load, and --push flags
intact.


# Build and push E2E test container for multiple architectures
image-e2e-push-multiarch:
docker buildx build -f Containerfile.e2e \
$(CONTAINER_ENGINE) buildx build -f Containerfile.e2e \
--platform $(PLATFORMS) \
-t $(IMAGE_REPO)-e2e:$(IMAGE_TAG) \
-t $(IMAGE_REPO)-e2e:$(GIT_SHA) \
Expand All @@ -240,7 +243,7 @@ GINKGO_CMD += --junit-report=junit.xml --output-dir=/app/test-results ./test/e2e
test-e2e-container: image-e2e-multiarch
@echo "✅ Exporting static credentials from profile $(AWS_PROFILE)..."
@eval "$$(aws configure export-credentials --profile $(AWS_PROFILE) --format env-no-export)" && \
docker run --rm \
$(CONTAINER_ENGINE) run --rm \
-e E2E_BASE_URL="$(BASE_URL)" \
-e E2E_ACCOUNT_ID="$(E2E_ACCOUNT_ID)" \
-e AWS_ACCESS_KEY_ID="$$AWS_ACCESS_KEY_ID" \
Expand All @@ -251,10 +254,10 @@ test-e2e-container: image-e2e-multiarch
$(IMAGE_REPO)-e2e:$(IMAGE_TAG) \
$(GINKGO_CMD)

# Push Docker image
# Push container image
image-push: image
docker push $(IMAGE_REPO):$(IMAGE_TAG)
docker push $(IMAGE_REPO):$(GIT_SHA)
$(CONTAINER_ENGINE) push $(IMAGE_REPO):$(IMAGE_TAG)
$(CONTAINER_ENGINE) push $(IMAGE_REPO):$(GIT_SHA)

# Run locally
run: build
Expand Down
19 changes: 6 additions & 13 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,11 +195,11 @@ make test-e2e-container \
- Set `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` directly, OR
- Ensure your credentials file contains all necessary settings

**Or use Docker/Podman directly**:
**Or use Podman/Docker directly**:

Standard approach (mounts entire `~/.aws` directory):
```bash
docker run --rm \
podman run --rm \
-e E2E_BASE_URL="https://xxxxx.execute-api.us-east-2.amazonaws.com/prod" \
-e E2E_ACCOUNT_ID="123456789012" \
-e AWS_PROFILE="my-aws-profile" \
Expand All @@ -212,7 +212,7 @@ docker run --rm \

With a custom credentials directory:
```bash
docker run --rm \
podman run --rm \
-e E2E_BASE_URL="https://xxxxx.execute-api.us-east-2.amazonaws.com/prod" \
-e AWS_PROFILE="my-profile" \
-e AWS_REGION="us-east-2" \
Expand Down Expand Up @@ -261,16 +261,9 @@ make test-e2e-container \
make test-e2e-container BASE_URL="${API_URL}"
```

**Using Podman instead of Docker**:
**Using Docker instead of Podman**:
```bash
# Replace 'docker' with 'podman' in any command
podman run --rm \
-e E2E_BASE_URL="https://xxxxx.execute-api.us-east-2.amazonaws.com/prod" \
-e AWS_PROFILE="my-profile" \
-e AWS_SDK_LOAD_CONFIG=1 \
-v $(pwd)/test-results:/app/test-results \
-v ~/.aws:/root/.aws:ro \
quay.io/openshift-online/rosa-regional-platform-api-e2e:latest
# Replace 'podman' with 'docker' in any command, or set CONTAINER_ENGINE=docker for make targets
```

#### Troubleshooting AWS Credentials
Expand Down Expand Up @@ -341,7 +334,7 @@ Or, get temporary credentials from your credential process locally and pass them
aws configure export-credentials --profile rrp-chris-regional_cluster --format env

# Then use the output to set env vars and run without mounting credentials
docker run --rm \
podman run --rm \
-e E2E_BASE_URL="https://xxxxx.execute-api.us-east-2.amazonaws.com/prod" \
-e AWS_ACCESS_KEY_ID="..." \
-e AWS_SECRET_ACCESS_KEY="..." \
Expand Down
10 changes: 5 additions & 5 deletions ci/build-push-image.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,13 +20,13 @@ SHORT_SHA="${GIT_SHA:0:7}"

echo "Building image: ${IMAGE_REPO}:${SHORT_SHA}"

# Detect container runtime
if command -v docker &>/dev/null; then
RUNTIME=docker
elif command -v podman &>/dev/null; then
# Detect container runtime (prefer podman)
if command -v podman &>/dev/null; then
RUNTIME=podman
elif command -v docker &>/dev/null; then
RUNTIME=docker
else
echo "ERROR: neither docker nor podman found" >&2
echo "ERROR: neither podman nor docker found" >&2
exit 1
fi

Expand Down